--- title: "Working with triggered alerts" canonical: "https://docs.devo.com/space/latest/405700609/Working%20with%20triggered%20alerts" format: markdown ---
Watch video In this video, you can see the highlights of the triggered alerts area and some guidelines on how to use it.
[ [Overview](https://devodocs.atlassian.net/wiki/spaces/LAD/pages/1261928726/Triggered+Alerts#Overview) ] [ [Data table registry of triggered alerts](https://devodocs.atlassian.net/wiki/spaces/LAD/pages/1261928726/Triggered+Alerts#Data-table-registry-of-triggered-alerts) ] [ [What tasks can be performed in the Alerts overview?](https://devodocs.atlassian.net/wiki/spaces/LAD/pages/1261928726/Triggered+Alerts#What-tasks-can-be-performed-in-the-Alerts-overview%3F) ] [ [What permissions do I need?](https://devodocs.atlassian.net/wiki/spaces/LAD/pages/1261928726/Triggered+Alerts#What-permissions-do-I-need%3F) ] ## Overview When an alert is triggered, a notification is sent through the specified channel. By managing [Delivery Methods](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95127270), you can set up and manage how and to whom alerts can be delivered. > ℹ️ Delivery methods are managed in the **Administration → Alert configuration** **→** **Delivery Methods** tab. Further, inside the relevant delivery method type tab, you can manage the delivery method. This notification contains the details of the triggered alert and a link to access them in Devo. This allows the recipient to analyze the details and decide on a course of action. Here is an example of an alert notification sent via email. ![2_Managing triggered alerts.png](media://8dabc273-c655-4903-869e-e745c7f9b4b0) Furthermore, all triggered alerts are displayed under the **Alerts →** **Overview** tab. ![image-20250326-191158.png](media://a50ff32f-afae-4030-89b8-8bd88a766148) This** **is your control panel to track the alerts that have been triggered over time. There are two parts: - **Top area**: it displays a dynamic chart to visually analyze the overall quantity of alerts displayed in the bottom area, and the triaging options to filter them. - **Bottom area**: it lists all the alerts triggered in the domain, starting with the most recent one, and gives you the ability to carry out workflows related to managing the conditions that trigger the alerts. ## Data table registry of triggered alerts All triggered alerts are registered in the [siem.logtrust.alert.info](https://docs.devo.com/space/latest/95206409/Alerts+monitoring#siem.logtrust.alert.info) table at the time of generation. Additionally, they are registered in the [devo.audit.alert.triggered](https://docs.devo.com/space/latest/95206409/Alerts+monitoring#devo.audit.alert.triggered) table, which maintains a comprehensive record of all subsequent changes they undergo during their lifecycle. > ℹ️ When an alert should have been triggered but was not, for whatever reason, it is registered as an error in the [siem.logtrust.alert.error](https://docs.devo.com/space/latest/95206409/Alerts+monitoring#siem.logtrust.alert.error) table. ## What tasks can be performed in the Alerts overview? These are the different tasks you can perform in this area, such as: - [Visualize triggered alerts](https://devodocs.atlassian.net/wiki/spaces/latest/pages/530153550) - [Manage triggered alerts](https://devodocs.atlassian.net/wiki/spaces/latest/pages/405700870) ## What permissions do I need? As there are many different tasks with different contexts to perform in this area, the set of permissions required is consequently very granular: - To access this area to see triggered alerts, see their details, open their queries, and create comments, you need the *View* version of the *Triggered alerts* permission. - To change the priority and status of the alerts or create post-filters, you also need the child permission to *Update status/priority.* - To access the alert shared by the root domain, you need the [child view permissions](https://docs.devo.com/space/latest/1333526603/Sharing+alerts+between+domains#Child-domain). - The *Manage* version of the *Triggered alerts* permission allows you to do all the above, and delete alerts (more info about permissions [here](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94763681)). - The actions that imply interacting with the alerts definition will not show unless you have the *Manage* level of the *Alert configuration* permission (know more about alert definitions [here](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95127087)). - Additionally, you need to have alerts assigned (see [Assign resources to a role](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94763463)). You will only see triggered alerts for those alerts assigned and permitting only the interaction level specified for them. In other words, the permissions grant theoretical access to alerts, while assigning a specific alert grants the actual access. ![10_Managing triggered alerts.png](media://80c67424-d5f6-46a6-895c-c764a8158747)